The present invention generally relates to packet-switched data networks, such as ethernet networks wherein information is transferred, for example, between terminals connected to nodes in the network by means of packets which comply with agreed transmission formats and contain, in addition to information provided by or received by the users who are connected to the network, address and control information.
Typically, a data packet of the kind which can be monitored in accordance with the present invention includes address data which relates to signal flow paths in the network and other address data (called herein network address data) which relates to users connected to the network. Examples of the former are media access control (MAC) addresses and examples of the latter are network addresses of data sources and destinations and protocol address data such as IP (Internet protocol). Normally a packet will contain a header which includes both types of address data. It will be understood that in the usual operation of a large scale network, the address data which relates to signal paths (called hereinafter path address data) may be common to a multiplicity of network addresses.
Various transmission conventions prescribe a particular layering of the network devices and the data which control them. The path address data (and specifically the media access control addresses) are by convention termed Layer 2 (L2) and the network address data previously mentioned are conventionally termed Layer 3 (L3) addresses, in particular conforming to the IEEE.802 formats.
It is known practice to monitor traffic flow in network segments or paths identified or indexed according to the path data addresses (MAC addresses) of packets traversing the network. It is theoretically possible to compute traffic flows indexed according to selected data identifying network segments, or relevant users or packet types by monitoring all the packets. However, such monitoring requires very substantial data processing. Where, as is frequent, processing resources are limited, as in for example network switches and other networking devices, instead of gathering statistics on all the network traffic, packets can be sampled, typically randomly, pseudo randomly or periodically, and the sampled data may be scaled appropriately to estimate the actual network traffic based on the characteristics of the samples so as to derive figures for network traffic indexed according to selected packet types, identified by source, destination, protocol or other selected criteria.
The measurement of traffic flow may be in terms of the number of packets or the information content, usually the the total number of octets, or both. Where a measure of both the octet count and the packet count is required, scaling factors may typically be calculated by estimating a mean packet rate or octet rate for an interval over which samples have been acquired and using the mean rate to scale the sampled data.
Scaling data using a mean packet rate or octet rate is generally known. It has been implemented for what are known conventionally as RMON1 statistics. For the present purposes, RMON1 statistics are intended to include traffic flow data indexed according to data flow paths, i.e. MAC or L2 addresses.
It is possible to derive RMON2 data, for example measures of traffic flow related to source and destination terminals or L3 addresses rather than network nodes or segments, by means of scaling from mean rates. However, the object of the present invention is to improve the collection of RMON2 statistics by using actual measures of traffic flow.
In particular, the present invention is based on the use of actual traffic flow data related to data path addresses, and particularly RMON1 data, to perform the scaling of sampled data relating to network addresses, and particularly RMON2 data.
Broadly, the present invention concerns a method of computing statistics relating to the flow of data by way of a packet-based data transmission system wherein a packet includes path address data (as herein defined) and network address data (as herein defined) and wherein the network includes means for providing traffic flow data indexed according to each of a plurality of traffic flow paths identified by the path address data. In a specific example, the said means for providing such traffic flow data may be constituted by a RMON1 matrix table.
A first feature of the invention is the sampling of data packets and the accumulation, for each of a multiplicity of packet types indexed according to selected network address data within the packets, traffic flow counts which are respectively incremented in response to each new sample data packet of the respective type.
Although in some circumstances it may be necessary to read all of a packet when sampling, it is generally preferable to read only part, and particularly a header portion containing address data.
Another feature of the invention is the accumulation, for each traffic flow path indicated in sample packets, a respective one of a plurality of reference traffic flow counts, the reference traffic flow counts being incremented in response to each new sample data packet relevant to the respective traffic flow path.
Another feature of the invention concerns storing values corresponding to said traffic flow data for each of the traffic flow paths for which said reference traffic flow counts are accumulated.
A further feature of the invention concerns obtaining an indication of the traffic flow for a packet type by scaling the respective accumulated count in accordance with the ratio between a count from the traffic flow data for the traffic flow path relevant to the packet type count and the respective reference count.
The invention is further described with reference to the accompanying drawings.